Users, groups & permissions

This page covers looking up people, managing user accounts and groups, and inspecting permission schemes (the rules that decide who can do what on a project). It's the most heavily admin-gated page in this documentation: of the 56 tools listed below, 37 only work — and only even appear to the agent — when your MCP server deployment has an admin token (JIRA_ADMIN_TOKEN) configured. If you only have the standard token, you can still look people up and check who's assignable to a project; everything that creates, changes, or deletes an account, group, or permission scheme needs the admin token.

Example prompts

Works without an admin token:

• "Look up the Jira account for jsmith."
• "Who can be assigned to PROJ-123?"
• "Search for users with 'chen' in their name or email."
• "Find people across the PROJ and OPS projects who could pick up this ticket."
• "Would 'Summer2026!' pass our password policy for a new account?"
• "How many duplicate user accounts do we have from the LDAP sync?"

Needs an admin token:

• "Create a new Jira account for our new hire, Priya Patel."
• "Add jsmith to the Developers group."
• "What does the Developers permission scheme grant?"
• "Reset dwilson's password."
• "Remove ex-employee mjones's Jira Software license."
• "Permanently delete the old test account qa-bot." (the agent will ask you to confirm first)
• "Anonymize the account for a user who submitted a data-erasure request."
• "List all our permission schemes."

What's available

Looking up people (no admin token needed)

Tool	What it does
get_user	Get a single user by username or key
list_users	List all users on the instance, page by page
search_users	Find users by a username or query substring
get_users_picker	Find users for a typeahead picker by query
find_assignable_users	Find users assignable to a specific issue or project
find_bulk_assignable_users	Find users assignable across multiple projects at once
find_users_with_browse_permission	Find users with permission to browse a given issue or project
find_users_with_permission	Find users holding all of the given permissions on a project or issue
get_user_avatars	Get all avatars (system and custom) available for a user
get_user_columns	Get a user's configured default issue-list columns
get_user_properties	Get the property keys stored on a user
get_user_property	Get a single user property's value by key
get_user_a11y_settings	Get a user's accessibility personal settings (e.g. underlined links, status patterns)
check_password_policy_create_user	Check if a candidate password would pass policy for a new account
check_password_policy_update_user	Check if a candidate new password would pass policy for an existing user
get_duplicated_users_count	Get the count of duplicated user accounts (an LDAP/directory-sync diagnostic)
get_duplicated_users_list	Get the mapping of duplicated user accounts (an LDAP/directory-sync diagnostic)
get_user_anonymization_progress	Get the progress of a scheduled anonymization task
get_user_anonymization_rerun_validation	Check (dry run) whether a past anonymization can safely be re-run
get_user_anonymization_validation	Check (dry run) whether a user can safely be anonymized

User accounts: create, edit & credentials (admin)

Tool	What it does
create_user	Create a new Jira user account
update_user	Update an existing user's name, email, display name, active status, or licenses
update_user_password	Change a user's password
delete_user	Permanently delete a user account — irreversible. Requires confirm:true
add_user_to_application	Add a user to an application (grant a license/seat)
remove_user_from_application	Remove a user from an application (revoke a license/seat). Requires confirm:true
set_user_columns	Set a user's default issue-list columns, replacing the full list
reset_user_columns	Reset a user's default issue-list columns to the system default. Requires confirm:true
set_user_property	Set the value of a named property on a user (arbitrary JSON)
delete_user_property	Delete a named property from a user. Requires confirm:true
delete_user_session	Forcibly terminate all of a user's active sessions. Requires confirm:true

User avatars (admin)

Tool	What it does
store_temporary_user_avatar	Upload image bytes as a temporary avatar (step 1 of the upload/crop flow)
create_user_avatar_from_temporary	Convert a temporary avatar into a real, selectable custom avatar
update_user_avatar	Assign an existing (system or custom) avatar to a user by id
delete_user_avatar	Delete a custom user avatar by id. Requires confirm:true

User anonymization (admin)

Tool	What it does
schedule_user_anonymization	Schedule irreversible anonymization of a user's identity and disable the account
schedule_user_anonymization_rerun	Schedule a re-run of a previous anonymization, e.g. after a partial failure
delete_stale_user_anonymization_task	Delete a stuck anonymization task lock so a new one can run. Requires confirm:true

Groups (admin)

Tool	What it does
add_user_to_group	Add a user to a group
remove_user_from_group	Remove a user from a group. Requires confirm:true
create_group	Create a new group
delete_group	Delete a group. Requires confirm:true
get_groups_picker	Find groups matching a query string, typeahead-style
get_group_user_picker	Find users and groups matching a query in one call, with highlighting

Permission & notification schemes (admin)

A permission scheme is Jira's rulebook for who can view, edit, assign, or administer issues on a project. A notification scheme controls who gets emailed when things happen on a project.

Tool	What it does
admin_list_permission_schemes	List all permission schemes on the instance
admin_get_permission_scheme	Get a single permission scheme by ID
admin_create_permission_scheme	Create a new permission scheme
admin_update_permission_scheme	Update a permission scheme's name or description
admin_delete_permission_scheme	Permanently delete a permission scheme by ID. Requires confirm:true
admin_get_permission_scheme_grants	Get all grants of a scheme — which users/groups/roles hold which permissions
admin_get_permission_scheme_grant	Get a single permission grant by ID from a scheme
admin_create_permission_scheme_grant	Grant a permission in a scheme to a holder (user, group, project role, etc.)
admin_delete_permission_scheme_grant	Delete a permission grant from a scheme. Requires confirm:true
admin_get_permission_scheme_attribute	Get a permission scheme attribute by key
admin_set_permission_scheme_attribute	Update or insert a permission scheme attribute
admin_list_notification_schemes	List all notification schemes on the instance
admin_get_notification_scheme	Get full details of a single notification scheme, including event notifications

Admin access

37 of the 56 tools on this page require JIRA_ADMIN_TOKEN. If it isn't configured, those tools aren't just blocked — they're never advertised to the agent at all, so it won't try to reach for them.

• Groups — fully admin-gated. All 6 group tools, including just finding a group by name (get_groups_picker), need the admin token.
• Permission & notification schemes — fully admin-gated. All 13 tools, including read-only ones like admin_get_permission_scheme, need the admin token. There is no non-admin way to inspect a permission scheme.
• User accounts — partially gated. Looking someone up, searching, checking assignability, and checking password policy all work with the standard token (19 tools). Creating, editing, deleting, or changing credentials for an account — plus avatars and anonymization — needs the admin token (18 tools).

Things to know

• Deletions and other hard-to-undo actions need explicit confirmation. These 11 tools require confirm:true, and the agent should always check with you before setting it: delete_user, delete_user_avatar, delete_user_property, delete_user_session, remove_user_from_application, reset_user_columns, delete_stale_user_anonymization_task, delete_group, remove_user_from_group, admin_delete_permission_scheme, and admin_delete_permission_scheme_grant. If your agent skips asking you to confirm before one of these runs, don't approve it.
• delete_user is irreversible and just as serious as deleting an issue — the account and its identity are gone for good.
• Anonymization isn't confirm-gated the same way, but is just as high-impact. schedule_user_anonymization scrambles a user's username, display name, and email and disables the account — useful for GDPR-style "right to be forgotten" requests where you need to remove personal data without breaking historical issue history. It doesn't require confirm:true, but it's asynchronous and has no built-in undo, so run get_user_anonymization_validation first and confirm with the requester before scheduling it. Check progress afterward with get_user_anonymization_progress.
• Check a password before you set it. check_password_policy_create_user and check_password_policy_update_user let you validate a candidate password against the instance's policy without actually creating an account or changing anyone's credentials.
• Duplicate-user tools are diagnostics, not fixes. get_duplicated_users_count and get_duplicated_users_list surface accounts that LDAP/directory sync has duplicated; they don't merge or remove anything themselves.

See docs/api-catalog.md for the complete technical reference (every field, every parameter). For errors, see Troubleshooting.